Devman
Devman is a ransomware operation first identified in early 2025 and described in reporting as a non-public, closed operation rather than a public RaaS platform. Multiple sources in the provided content link Devman to the DragonForce ecosystem or code lineage, and technical analysis states DEVMAN samples largely reuse DragonForce code derived from Conti while adding Devman-specific customization. Reported overlaps include builder strings such as "DEVMAN 3.0," near-identical ransom notes, and matching "DM"-prefixed lateral movement task naming seen in related reporting. Devman has also been described as having partnerships through multiple RaaS services including Qilin, DragonForce, and RansomHub.
The malware is associated with double-extortion activity and targeted intrusions against high-value organizations. Reporting in the content says Devman continued targeted penetration of industrial organizations and intensified targeting of critical infrastructure and healthcare, with victim concentration in Asia and Africa and some activity in Latin America and Europe. One report notes attacks encrypting all systems and NAS devices in a Thailand incident. Another states Devman transitioned from version 1.0 written in C++ to version 2.0 in Rust.
Observed Devman indicators and behaviors include encrypted file extensions ".DEVMAN" and ".devman1," and a deterministic ransom-note filename "e47qfsnz2trbkhnt.devman." Technical analysis of a DEVMAN sample found it appending the .DEVMAN extension, scrambling filenames, probing SMB shares including ADMIN$ for discovery and lateral movement, checking for Volume Shadow Copies, using the Windows Restart Manager to access locked files, and supporting full, header-only, and custom encryption modes. The sample appeared to operate largely offline with no observed external C2 beyond SMB probing. A builder flaw reportedly caused the malware to encrypt its own ransom notes, leaving scrambled .DEVMAN files instead of readable notes. Additional reported artifacts include a hardcoded mutex "hsfjuukjzloqu28oajh727190" and Restart Manager-related mutexes following the pattern "Local\RstrMgr-[GUID]-Session0000."
The content associates Devman with over 180 claimed victims in one reference, while other reporting cites nearly 40 claimed victims and Q1 2026 victim counts declining from 82 to 25 after operator "Tramp," described as a former Conti and Black Basta affiliate, was added to Interpol’s wanted list in January 2026. Devman’s February 2026 dormancy is noted as coinciding with the debut of Vect, prompting reporting about possible continuity or rebranding, but that linkage remains inferential in the provided material.
High-confidence IOCs directly mentioned in the content include encrypted extensions ".DEVMAN" and ".devman1," ransom-note filename "e47qfsnz2trbkhnt.devman," MD5 "e84270afa3030b48dc9e0c53a35c65aa," SHA256 "df5ab9015833023a03f92a797e20196672c1d6525501a9f9a94a45b0904c7," and SHA256 "018494565257ef2b6a4e68f1c3e7573b87fc53bd5828c9c5127f31d37ea964f8."
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Devman declined by 70%, from 82 victims to 25. The ransomware’s operator “Tramp”, a former Conti and Black Basta affiliate, was added to Interpol’s wanted list in January 2026.
“Security researchers have reportedly identified Devman ransomware payloads that are build on DragonForce infrastructure.”
Recent activity
13 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Devman is a ransomware family linked in reporting to Vect through shared builder strings, matching DM-prefixed lateral movement task naming, and similar ransom notes. The content suggests possible operator continuity, rebranding, or code overlap.
A ransomware family linked in reporting to Vect through shared strings, ransom-note similarities, and matching lateral movement task naming conventions. The content suggests possible operator continuity, rebranding, or code overlap.
A ransomware operation whose activity collapsed after pressure on its operator and shutdown of its leak sites; it had links to a former Conti and Black Basta affiliate.
A separate ransomware group/family referenced inside Vect payloads; similarities in ransom notes, debug strings, and a hardcoded 'DM' prefix suggest a possible connection to Vect.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.